|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #75978 Improper parsing
Submitted: 2018-02-18 19:49 UTC Modified: 2018-02-20 02:39 UTC
From: fwilliams22 at gmail dot com Assigned: peehaa (profile)
Status: Closed Package: Strings related
PHP Version: Irrelevant OS: Windows/Linux
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
Block user comment
Status: Assign to:
Bug Type:
From: fwilliams22 at gmail dot com
New email:
PHP Version: OS:


 [2018-02-18 19:49 UTC] fwilliams22 at gmail dot com
"CVS" string processing fails to properly parse " (quote) delimited fields.
delimited fields containing an ' (apostrophe) fail to parse correctly.  Appears that parser recognizes an embedded apostrophe as a field delimiter.

My workaround is:

while (($data = fgets($handle, 500))) {
	$data = str_replace("'","\\'",$data);				
        $data = str_getcsv($data, ",",'"');
	$query = "INSERT INTO `address` 
           (`fname`,`lname`,`address`,`city`,`state`," .
           " VALUES '$data[0]','$data[1]','$data[2]','$data[3]'," .
	$result = $db->exec($query);

Not all test cases seem to fail.  I have had to use the above workaround to update a MySQL table.  The below example test script seems to have worked leaving "\\'" in the test field?

Anyhow that's my story and I'm sticking to it.

Could be the issue is in the PDO MySQL driver?

One of 'em needs more testing.

Test script:
$data = "\"Got'ta apostrophe you can spare?\"";
$data = str_replace("'","\\'",$data);				
$data = str_getcsv($data, ",",'"');


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2018-02-18 20:00 UTC]
-Status: Open +Status: Feedback
 [2018-02-18 20:00 UTC]
It's a bit hard to understand what the problem is reporting, but by the looks of it it's just an SQL injection by yourself?

Use prepared statements so you don't have these problems.
 [2018-02-18 20:01 UTC]
> "CVS" string processing fails to properly parse " (quote) delimited fields.

Works fine:
 [2018-02-18 20:24 UTC] spam2 at rhsoft dot net
hell, learn about value escaping which are basics when you deal with databases

every non hardcoded input is untrusted and bad until the opposite is prove3
 [2018-02-20 02:39 UTC]
-Status: Feedback +Status: Closed -Assigned To: +Assigned To: peehaa
 [2018-02-20 02:39 UTC]
Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at and the instructions on how to report
a bug at
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Wed Jul 24 10:01:28 2024 UTC